From f5efef2835099d389a40f88d36b178066d71b474 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Sat, 7 Jun 2025 11:28:39 +0100
Subject: [PATCH] cc-wrapper: tidy logic for implied hardening flags

this can be done more neatly than my previous just-copy-the-blocks
approach
---
 .../build-support/cc-wrapper/add-hardening.sh | 26 ++++++++-----------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh
index 2dcf1516d2de..319225a6ed87 100644
--- a/pkgs/build-support/cc-wrapper/add-hardening.sh
+++ b/pkgs/build-support/cc-wrapper/add-hardening.sh
@@ -18,21 +18,6 @@ if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
   hardeningEnableMap["fortify"]=1
 fi
 
-# Remove unsupported flags.
-for flag in @hardening_unsupported_flags@; do
-  unset -v "hardeningEnableMap[$flag]"
-  # fortify being unsupported implies fortify3 is unsupported
-  if [[ "$flag" = 'fortify' ]] ; then
-    unset -v "hardeningEnableMap['fortify3']"
-  fi
-done
-
-# now make fortify and fortify3 mutually exclusive
-if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
-  unset -v "hardeningEnableMap['fortify']"
-fi
-
-
 # strictflexarrays3 implies strictflexarrays1 enablement - make explicit before
 # we filter unsupported flags because unsupporting strictflexarrays3
 # doesn't mean we should unsupport strictflexarrays1 too
@@ -40,15 +25,26 @@ if [[ -n "${hardeningEnableMap[strictflexarrays3]-}" ]]; then
   hardeningEnableMap["strictflexarrays1"]=1
 fi
 
+
 # Remove unsupported flags.
 for flag in @hardening_unsupported_flags@; do
   unset -v "hardeningEnableMap[$flag]"
+  # fortify being unsupported implies fortify3 is unsupported
+  if [[ "$flag" = 'fortify' ]] ; then
+    unset -v "hardeningEnableMap['fortify3']"
+  fi
   # strictflexarrays1 being unsupported implies strictflexarrays3 is unsupported
   if [[ "$flag" = 'strictflexarrays1' ]] ; then
     unset -v "hardeningEnableMap['strictflexarrays3']"
   fi
 done
 
+
+# now make fortify and fortify3 mutually exclusive
+if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then
+  unset -v "hardeningEnableMap['fortify']"
+fi
+
 # now make strictflexarrays1 and strictflexarrays3 mutually exclusive
 if [[ -n "${hardeningEnableMap[strictflexarrays3]-}" ]]; then
   unset -v "hardeningEnableMap['strictflexarrays1']"